PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-08 05:31:31 +00:00
Code Issues Projects Releases Wiki Activity

Allows ncat to properly process HTTP passwords that are either empty or contain colons. Fixes #984

Browse Source
This commit is contained in:
nnposter
2017-09-23 22:53:19 +00:00
parent 6e83dc6406
commit 1bc9f186b9
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ncat/ncat_connect.c
View File

@@ -399,12 +399,13 @@ static char *http_connect_request_auth(char* host_str, unsigned short port, int
/* Split up the proxy auth argument. */ /* Split up the proxy auth argument. */
proxy_auth = Strdup(o.proxy_auth); proxy_auth = Strdup(o.proxy_auth);
username = strtok(proxy_auth, ":"); username = proxy_auth;
password = strtok(NULL, ":"); password = strchr(proxy_auth, ':');
if (password == NULL) { if (password == NULL) {
free(proxy_auth); free(proxy_auth);
return NULL; return NULL;
} }
*password++ = '\0';
response_hdr = http_digest_proxy_authorization(challenge, response_hdr = http_digest_proxy_authorization(challenge,
username, password, "CONNECT", sock_to_url(o.target,o.portno)); username, password, "CONNECT", sock_to_url(o.target,o.portno));
if (response_hdr == NULL) { if (response_hdr == NULL) {

5
ncat/ncat_proxy.c
View File

@@ -888,12 +888,13 @@ static int check_auth(const struct http_request *request,
/* Split up the proxy auth argument. */ /* Split up the proxy auth argument. */
proxy_auth = Strdup(o.proxy_auth); proxy_auth = Strdup(o.proxy_auth);
username = strtok(proxy_auth, ":"); username = proxy_auth;
password = strtok(NULL, ":"); password = strchr(proxy_auth, ':');
if (password == NULL) { if (password == NULL) {
free(proxy_auth); free(proxy_auth);
return 0; return 0;
} }
*password++ = '\0';
ret = http_digest_check_credentials(username, "Ncat", password, ret = http_digest_check_credentials(username, "Ncat", password,
request->method, credentials); request->method, credentials);
free(proxy_auth); free(proxy_auth);